Upgrading SonarQubeCloud tasks from v2 to v4 in ADO changed total LOC analyzed

SonarQube Cloud
1

Template for a good new topic, formatted with Markdown:

  • ALM used : Azure DevOps Services
  • CI system used: Azure DevOps
  • Scanner command used when applicable (private details masked)
  • Languages of the repository : C#

We’ve been using SonarQube Cloud in our Azure DevOps pipeline for a while, and we decided to do some maintenance to use v4 tasks instead of v2 tasks.

By doing so, scanner mode changed from msbuild to dotnet.

Our repository is a MonoRepo and we created a project for each solution we want to analyse.

Problem is that with changes of scanner the analysis now occurs on every cs file of the repository and so our LOC consumed exploded :

image
image279×1017 11.6 KB

image
image247×735 18.9 KB

Is it possible to change configuration so it analyses only compiled files ? Or should we add in the project configuration each folder to analyse ?

Thanks for your help,

Best regards

2

Hi @AlexJulita,

Thanks for reaching out with your question.

This is a known behaviour change when upgrading to the v4 Azure DevOps tasks. The v4 tasks bundle SonarScanner for .NET v8.0+, which introduced multi-language analysis (sonar.scanner.scanAll) and enabled it by default, see this announcement: SonarScanner for .NET 8, now with other languages auto-detection . That’s the root cause of your LOC growth.

With the old v2 tasks (MSBuild mode), the scanner only counted files explicitly referenced in your .csproj files. With scanAll enabled, it now walks the entire repository and picks up every eligible file — which in a MonoRepo means all .cs files across all solutions, not just the ones being compiled by the solution you’re analysing.

To ‘fix’ this, you can add sonar.scanner.scanAll=false to the extraProperties of each Prepare Analysis Configuration task:

- task: SonarQubePrepare@6
  inputs:
    SonarQube: 'SonarQubeCloud'
    scannerMode: 'dotnet'
    projectKey: 'your-project-key'
    extraProperties: |
      sonar.scanner.scanAll=false

Setting this to false restores the previous behaviour: only files that are part of the build (linked by the .csproj) will be analysed.

If you prefer to keep multi-language analysis on (e.g. for YAML, XML, etc.) but need to exclude other solutions’ directories, you can instead scope each project with sonar.exclusions:

sonar.exclusions=**/OtherSolution/**,**/AnotherSolution/**

Or use sonar.sources to explicitly name the root of the solution being analysed.

For full details, see the Configuring the scanner docs.

Hope that helps!

Best regards,

Stevan